CVE-2020-26063
published 2024-11-18CVE-2020-26063: A vulnerability in the API endpoints of Cisco Integrated Management Controller could allow an authenticated, remote attacker to bypass authorization and take…
PriorityP335medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.61%
45.4th percentile
A vulnerability in the API endpoints of Cisco Integrated Management Controller could allow an authenticated, remote attacker to bypass authorization and take actions on a vulnerable system without authorization.
The vulnerability is due to improper authorization checks on API endpoints. An attacker could exploit this vulnerability by sending malicious requests to an API endpoint. An exploit could allow the attacker to download files from or modify limited configuration options on the affected system.There are no workarounds that address this vulnerability.
Affected
44 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
| cisco | cisco_unified_computing_system | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
vendor_cisco5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Integrated Management Controller Authorization Bypass Vulnerability
vendor_cisco·2020-11-04·CVSS 5.4
CVE-2020-26063 [MEDIUM] CWE-269 Cisco Integrated Management Controller Authorization Bypass Vulnerability
Cisco Integrated Management Controller Authorization Bypass Vulnerability
A vulnerability in the API endpoints of Cisco Integrated Management Controller could allow an authenticated, remote attacker to bypass authorization and take actions on a vulnerable system without authorization.
The vulnerability is due to improper authorization checks on API endpoints. An attacker could exploit this vulnerability by sending malicious requests to an API endpoint. An exploit could allow the attacker to download files from or modify limited configuration options on the affected system.
There are no workarounds that address this vulnerability.
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-zWkppJxL
Cisco
Cisco Integrated Management Controller Authorization Bypass Vulnerability
vendor_cisco·CVSS 3.1
CVE-2020-26063 Cisco Integrated Management Controller Authorization Bypass Vulnerability
CVE-2020-26063: Cisco Integrated Management Controller Authorization Bypass Vulnerability
A vulnerability in the API endpoints of Cisco Integrated Management Controller could allow an authenticated, remote attacker to bypass authorization and take actions on a vulnerable system without authorization. The vulnerability is due to improper authorization checks on API endpoints. An attacker could exploit this vulnerability by sending malicious requests to an API endpoint. An exploit could allow the attacker to download files from or modify limited configuration options on the affected system. There are no
CVSS: 3.1
CWE: CWE-269, CWE-269
Bug IDs: CSCvv07287, CSCvv95114
GHSA
GHSA-23p9-75pp-2wv4: A vulnerability in the API endpoints of Cisco Integrated Management Controller could allow an authenticated, remote attacker to bypass authorization a
ghsa_unreviewed·2024-11-18
CVE-2020-26063 [MEDIUM] CWE-269 GHSA-23p9-75pp-2wv4: A vulnerability in the API endpoints of Cisco Integrated Management Controller could allow an authenticated, remote attacker to bypass authorization a
A vulnerability in the API endpoints of Cisco Integrated Management Controller could allow an authenticated, remote attacker to bypass authorization and take actions on a vulnerable system without authorization.
The vulnerability is due to improper authorization checks on API endpoints. An attacker could exploit this vulnerability by sending malicious requests to an API endpoint. An exploit could allow the attacker to download files from or modify limited configuration options on the affected system.There are no workarounds that address this vulnerability.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-zWkppJxLhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanx3-vrZbOqqDhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vsoln-arbfile-gtsEYxnshttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-teams-xss-zLW9tD3
2024-11-18
Published